Table of Contents
These two functions can be used to convert an image to and from base64 format
img-b64 -img "C:\Users\user\Desktop\image.jpg" -location desk
b64-img -file "C:\Users\user\Desktop\image.jpg" -location desk
This function will convert your image to base64 format
Use the image tag to provide the path of the image you are trying to convert
Using the Location parameter will determine if the file containing the base64 code is saved to the desktop or temp folder
If no location is designated it will save it to the desktop by default
function img-b64 {
[CmdletBinding()]
param (
[Parameter (Mandatory = $True, ValueFromPipeline = $True)]
[string]$img,
[Parameter (Mandatory = $False)]
[ValidateSet('desk', 'temp')]
[string]$location
)
if (!$location) {$location = "desk"}
$loc = switch ( $location )
{
"desk" { "$Env:USERPROFILE\Desktop"
}
"temp" { "$env:TMP"
}
}
[Convert]::ToBase64String((Get-Content -Path $img -Encoding Byte)) >> "$loc\encImage.txt"
}
This function will convert your base64 encoded file back into an image
Use the file tag to provide the path of the file you are trying to convert
Using the Location parameter will determine if the file containing the base64 code is saved to the desktop or temp folder
If no location is designated it will save it to the desktop by default
function b64-img {
[CmdletBinding()]
param (
[Parameter (Mandatory = $True)]
[string]$file,
[Parameter (Mandatory = $False)]
[ValidateSet('desk', 'temp')]
[string]$location
)
if (!$location) {$location = "desk"}
$loc = switch ( $location )
{
"desk" { "$Env:USERPROFILE\Desktop"
}
"temp" { "$env:TMP"
}
}
Add-Type -AssemblyName System.Drawing
$Base64 = Get-Content -Raw -Path $file
$Image = [Drawing.Bitmap]::FromStream([IO.MemoryStream][Convert]::FromBase64String($Base64))
$Image.Save("$loc\decImage.jpg")
}
Listed below are payloads that have used one of these functions: